YouSaid · the spoken record

Bruce Schneier

lines on the record: 120
first: 2020-01-03
most recent: 2020-01-03
sittings or episodes: 1
sources: podcast

Every line below is reproduced as it was said and linked to the record it came from. Nothing here is summarised or generated. Directory · Search · Corrections

“Facial recognition, I think, is really interesting in technology because you really can't separate the tech from its uses.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“It's hard to regulate. I mean, I'm not going to say this is easy. This is a very fast moving industry. And I think we need to figure out, we don't actually know how to legislate in the 21st century. Someone invents, I don't know, the telephone 100 years ago, and it takes 30, 40 years. Before it permeates society for us to figure out the law of the telephone. Someone invents a drone, and I remember this. There were the years we said we can't regulate drones. It's too early. You'll destroy the industry. Then suddenly everyone gets one for Christmas, and then it's too late to regulate drones.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Countries are already doing that. I mean, yes, it's a problem. It would be nice to have harmony, but the big worry about national laws that preempt state laws and the reason a lot of the tech companies push them is they know they're going to be lousy. It is much easier to have a lousy federal law than to have a few good state laws. And companies will scream that they can't Meet everything in order to try to get that watered down federal law. So be careful about the complaints. I mean, yes, it's a problem. But industries have been doing this since forever.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“That creates a real. Problem in that they're all different, that for these companies too, in terms of they're all different. So they just have to pick the one that's most powerful or the most stringent.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Is doing a lot with consumer protection, although the mandates are a little weird. There are things they can do about unfair and deceptive trade practices So I think we are going to see some push there, but primarily I am looking to Europe and to some of the states. New York is trying to regulate cryptocurrencies. California has a data privacy law and now Internet of Things law. Massachusetts is pushing. Some things we see a digital right to repair.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Where court cases, I think, will put this industry in line. We're seeing some movement in some of the federal agencies. I mentioned the FAA with aircrafts, department transportation with automobiles. Whoever regulates medical devices, I'm blanking on their name FDA. FA. FDA. The Federal Trade Commission”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“I think that's what we're stuck with. I just don't see the US government having an appetite to do this anytime soon. We might see some movement in the judiciary.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“And I think it's a really interesting feature of software that will benefit us, that well-written regulations in any large enough market. Move the whole world California, Europe, UK even, we'll move the whole world”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Right now, the car you buying the United States is not the same car you buy in Mexico Environmental laws are different, and the manufacturers tune their engines. The Facebook book you get in the United States is the exact same Facebook you get in Mexico. Because it's easier. So California has a law coming into force in January, no default passwords. The maker of a thermostat is going to change their software to meet California law. They're not going to sell two versions, one for California and the rest of us. We will all benefit from that law. Similarly, Europe has GDPR, big privacy law, and a lot of us, not in Europe, benefit from that. I used to work for IBM. They made a decision early on that they would implement GDPR worldwide because it was easier and cheaper to do that than to figure out who a European citizen was. Right.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“I think it is changing. I think the social media and democracy is starting to change things, but it's only changing things in the perceptions of people. It has to change things in the perceptions of rich people. For the US government notices. So I really, if we want change, I think it's going to be coming out of Europe first. And the neat thing about technology is that it's right one sell everywhere.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“There's not much. I mean, I tend to look towards Europe. Really is the regulatory superpower on the planet right now? And to the states, specifically California, New York, and Massachusetts. No appetite in the federal government, not just because... The federal government is pretty dysfunctional right now, but in general, there was just not an appetite to regulate the tech industry. It's just too powerful. And too valuable.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“The example Elizabeth Warren used, we talked about financial regulation that it is illegal to sell you a toaster. That will catch on fire. We can't sell you that. Yet we can sell you a financial product that would metaphorically catch on fire. We can sell you software that will metaphorically catch on fire. And we kind of need to fix those.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“They are random. But you're right, most people will not change the default. And we just have to accept that and make it so we protect the consumer from themselves, like we do in so many other aspects. the example that don't eat”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Oddly enough, I just had a Schleg lock and they had a default. I'm like, why is this here at all? Well, that's the default password. I'm like, why? I was like, it shouldn't have a default password because most people don't change it. And it was like, it was the longest argument with the installers. And I was like, do you understand why this is a problem? Like, anyway, go ahead.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“And the notion that a company can say, wait, our product is harmful, but if you tell us to make it not harmful, we won't be profitable. It's just not a valid argument In any other aspect of society other than software right now. So I think bringing software in line with everything else would make a lot of sense. We are missing both proscriptive Requirements. And we're starting to see some of this. California has a new law coming into force in January for Internet of Things that one of the things it says is no default passwords. And that is basic consumer protection. Now, that is like on the list of hundred things we have to do, that's one of them, but at least it's one of them. And the fact that it took us that long to get there sort of shows how far we need to go. But government is”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“privacy aspect and it's never one thing software has been long Product liability Laws, which like makes no sense. So just making software more in line with everything else. That if a product is defective, the victims of that defective nature can sue. I think we need more consumer protection. Rules like we have in any other industry? I think we need product safety rules. If Ford made a car that has a side effect of driving around the country would destroy democracy. They would not be allowed to sell that car And they couldn't say things like, I don't know. Maybe it had signs on the side. I'm not making this up.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“So, I think we need basic consumer protection regulations. So it's a combination of things. Let me sort of step back a little.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Those are computers. Existing regulations are pushing down. So airplanes, automobiles, medical devices, they are all regulating the computer aspects. Of those things, consumer devices, not so much. That's probably going to change as we start seeing more toys and small appliance.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“This enormous Commerce engine that generates so much value for society. Some of it is the fact that it didn't matter. That this is a word processor. This is a photo app. And these things became part of our society infrastructure sort of slowly through the back door. So, automobiles are regulated, medical devices are regulated But now”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“So, the US, and especially, there's almost none. And some of it is because the industry was so new. They're so complicated, no one knew how to regulate it because it was so valuable. People are afraid to touch”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Let's get into that. Talk about where you see regulation going because now everybody's talking about regulation. And whenever I give speeches about this, everyone's like, well, what are the laws in place about technology? I'm like, there are any. There's some very light regulations. And most of the regulations are pro-technology, such as Section 230 or whatever. A lot of them are facilitate development of technology. But in general, there aren't any laws. There's a few privacy bills scattered around the world. There's one in California. But otherwise, it's pretty light compared to most industries that are regulated in our society, like finance, chemicals, cigarettes, cars, things like that.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Things when it's objects. Some of it is our unwillingness to regulate technology at any level. Sort of given us this world where short-term corporate interests are the interests of governoral decisions. And when you have that, this is what you have.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“And what we know now is that's often sold as an asset. Yeah, exactly. What happens? Nobody does. Some of it is our consumer culture developing then junk. Some of it is the way technology when it's just software, we iterate all the time. And we're used to it when it's just software. We're not used to it when it's...”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Not going to be It's so funny. You say that years ago when Facebook was allowing all those third party apps on Facebook, I kept saying, what if that goes out of business? What happens to the data that you gave collected via Facebook? And what we know now is that's often sold as an asset. Yeah, exactly. What happens? Nobody does. So where did we find ourselves in that way? Because this is the way development is going now, right? It's sort of the develop and then junk and then move on to the next thing.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“So, I don't know, imagine a car. You buy a car today, software is two years old. Let's say you buy it, drive for 10 years, sell it, somebody else buys it, they drive for 10 years. At point, they sell it, and we're in the US, so somebody else buys it, puts on a boat, sends it to Latin America, where someone else buys it, drives another 10 to 20 years. So we're talking about the equivalent of taking a computer today from 1977. Trying to turn it on, put it online, making it work, making it secure. We have no idea how to maintain 40-year-old consumer software. And a lot of these are not going to be cars. They're going to be toys. They're going to be appliances, small appliances, internet gadgets, companies that are out of business where nobody knows what the code is, where they can't be maintained.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Think about your phones and your computers, you replace them not every three to five years. And every time it is more secure, it's better designed, and it's a better object. The systems in our world have a longer lifespan. You can replace your digital video recorder every 10 years, your refrigerator every 25 years. I got a new home thermostat two years ago. I expect to replace it approximately never. And yet, we're going to expect these devices to be on the internet for that long. Apple and Microsoft depreciate their operating systems after like eight years because it's hard to maintain the old stuff.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“We've gotten a lot more security from that process. That doesn't exist for a lot of low cost embedded systems. Those Omnity locks had no way to do that But a lot of these systems are designed offshore by third parties. Teams come together, right? The code disperse. They don't have the ability for people to write patches. They don't have the engineers on staff. Even worse. A lot of these devices can't be patched. Right now, the way you patch your home router is you throw it away and buy a new one. That's the mechanism. There isn't another one. Now, that works, that's actually a recent mechanism. It's terrible for the environment, but it does get us security. But we expect our devices to last a lot longer.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Dealing with breaks. So if you have a Windows machine, second Tuesday every month, you get about 90 different security upgrades in that patch Tuesday. You're on a Windows machine. It happens more ad hoc. But we can quickly repair and improve security when we find vulnerabilities. And that works great”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“We have to think of different ways to fix them. Think about your computers and your phones. The same is true for them, but there is this ecosystem of upgrade. So we don't know how to design secure software. No idea. So instead, we are agile. So every...”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“So, when you're thinking about the idea of class breaks, it iterates everywhere in terms of what you're using, whether it's going to be sensors or cameras in a home or whatever to all these products. How do you think of that differently if this is how these are architected that way, that they all break at the same time, or they all have one vulnerability means vulnerability for all of them?”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Because their mental model of way hotel locks fail is you have a locksmith on staff every few weeks someone can't get into their room and you call the locksmith. Not that we have 400 hotel rooms and they all have to be upgraded. They're just not used to that failure. And that's that difference. That's the notion of a class break”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“And that's true. And I work in security, but I understand the upside of all this technology. I mean, these are great technologies in the main, and they do an enormous amount of good for the world. But I tend to look at the downside. An example might be Amedi Locke. Hotels nowadays, they often have keyless entry systems. You get a key card, you wave in front of a reader. One of the companies that makes those locks is Om And a few years ago, a vulnerability was found in Omni Locks such that if you didn't have the right keycard, you could still break in And the way you had to repair that was to go to every hotel room door manually and change the ROMs and change the code in the lock. And hotels, by and large, never did it.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Right, would you just be one tire? Or maybe the cars have to be recalled because now there's a chance the screw to go loose. And we know that over the course of the year you're going to make this up. Every four or five days, one of the cars will have a screw loose and somebody will crash. Not the same as all screws are now loose and get those cars off the road in the next 10 minutes hurry”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“And these are now things that affect the world in a direct physical manner. So I'm worried about crashing all the cars. Or more realistically, all the cars of one make in one model a year.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“The notion of class breaks being brought to the real world. And this has to do with the way things fail. Think of cars. Cars have parts, parts break, and we know how cars fail. All of our communities, there are going to be these order repair shops. Because there's a steady stream of broken cars. Computers do not fail that way. Computers all work perfectly until one day when none of them do. And that is a notion of a class break that suddenly every copy of Windows is insecure, that all of your iPhones have a vulnerability.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“This field's book is a great title, that's true. I like evocative titles. I think of books in sort of a waterfall model. A title gets you either subtitle, subtitle gets to read the inside jacket copy, and that gets you to read the book. So I want a title that makes you stop and say, what is that about? But I'm trying to speak to something real.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Random people And that's true. A lot of these attacks we see, we don't know who does it. We can get good at attributing when we pay attention. United States has in the past few years attributed attacks to Russian actors, Chinese actors, North Korean actors, to Iranian actors. But sometimes it's not known who did it. I mentioned the Marriott hack. We're pretty sure that was the Chinese. It's not possible. It could have been criminals. Office personnel manager, we know, is the Chinese. The DNC servers, we know as the Russians. I mean, a lot of stuff we know. But there's a democratization of tactics that you don't see in conventional warfare.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Give people They're here. They're both basically the same. There are different ways of looking at it. Cybersecurity was Always a military term and a little bit derided in the Internet security community because we are thinking more about People and communities, and cybersecurity is more about national security and governments and nation state actors. They've kind of merged at this point. I mean, everyone's using the same tools, the same techniques, the same tactics. And, you know, in some ways it's surprising. And I remember 2014, October, the attack against Sony. In my community, there's a serious debate about whether this attack perpetrated by On nuclear power with a $20 billion military budget or a couple of guys in the basement somewhere. And that, in a sense, is extraordinary that you can't tell the difference.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Right, to be able to do this. Now we'll get back on track, really, and then we're going to get to facial recognition. In the next part, the distinguisher from internet security to cybersecurity. This is the military. They're both basically the same.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“And now they're not that they don't have the skill to. They don't have the legal ability to. That the license agreement from John Deere says you're not allowed to look at the software and repair. And there actually is black market tractor software available on the internet for people who want to do this. And we want to make this legal. I was running two bills in Massachusetts, one general and one about automobiles specifically.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“You're not allowed to repair your stuff. And that seems counter to the way society works and different states are trying to enact bills to give people the right to repair, to prohibit companies from denying you the right to repair your thing because of license agreements. John Deere is in a big battle with farmers. Because farmers are used to repairing their tractors. That's one of the things they do.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“So, the notion is that we have a right to repair our stuff. And if you have a car and it breaks, you can open up the hood and take a wrench and do car things. I'm not a car guy, but presumably people know how to do that stuff. As these things become computerized, there are license agreements about the software.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“There's a lot of corporate power over our data and over our ability to do things. We're in Massachusetts now. There's a right to repair bill. That is going to be on the next election. It'll be voted for as a.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“And that's actually not unreasonable. I know that. In addition to all these criminals, we talk about nation states. I'd worry a lot about the corporate power.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Life, right, right? That she's talking to someone who's like, someday Google will run your pancreas and then you don't pay them. And then they say, we're turning off your pancreas until you pay us kind of stuff. It was fascinating. I was like, oh, I never thought of that.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“That cybersecurity doesn't mean your spreadsheet crashes and you lose your data. It means your embedded heart monitor crashes and you lose your life. Right, right, right. That chain is talking.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Paying attention, and they got caught, they never would have gotten caught otherwise because they would have been going all these sort of low interest networks. So that's just an example. Now, I think things are changing. My last focus about this. that a lot of what we're talking about is data. When we start talking about things that actually hurt people, cars and medical devices, thermostats, I live in Minnesota, so I'm going to take some of my thermostat in the winter. My pipes can freeze. I can have a lot of property damage. That's going to change the security landscape because it'll be no longer about data, it'll be about life and property. And I think changes are coming, regulatory changes because of that.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Your photos, your email, the person who it's valuable to is you. And actually nobody else. So it makes no sense to steal it. What it makes sense for is to hide it from you and charge you to get it back. And if someone encrypts your photos and they're important to your life, you'll probably pay a few hundred dollars to get them back. And there's the So there's a couple of ransomware perpetrators in the Ukraine, and they are randomly attacking systems. They happen to lock up the Washington, D.C. camera system. A week before the last inauguration. On the one hand, wow, that was impressive. On the other hand, super bad luck because now the world is.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Okay, so ransomware is when someone encrypts your computer and charges you to get your data back. It's actually very clever. If you think about your data,”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT
“Because it's so international. There's a story a couple of weeks ago about ransomware, a couple of individuals in the Ukraine.”
2020-01-03 · Decoder with Nilay Patel · Recode Decode: Bruce Schneier · IDENTIFIED FROM THE TRANSCRIPT